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Case ID: 288A-SF-145486-1A 


1A Envelope 


ORIGINAL NOTES RE INTERVIEW OP|_I 

FD-597 RECEIPT FOR PROPERTY; FD-941 CONSENT TO SEARCH 
COMPUTERS; ONE CD WITH PRINTED COPIES 



SILICON VALLEY RCFL REPORT OF EXAMINATION DATED 11/17/2009; ! 
AND 08/09/2010 AND RETURN TO AGENCY RECEIPT DATED 08/19/2010 ! 
(NO REFERENCE SERIAL) ! 


! SF 


-ORIGINAL PACKAGE COPY FD192 (CHAINS OF CUSTODY) lA'D 
-ORIGINAL 1B2 ENCLOSED 


! SF 


-ORIGINAL PACKAGE COPY FD-192 OF 1B1 (EVIDENCE RETURNED) 
-COPY OF A SIGNED FD-597 


! SF 


FD-597 RECEIPT FOR PROPERTY RETURNED TO 
IMAGESHACK ON 4/27/12 (REF SERIAL 14) 


I 
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*U.$. GPO: 2004-307-714/90013 


FD-597 (Rev 8-11-94) 


Page 

UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property Received/Returned/Released/Seized 


jj-of _L 


File # 


0n ( date ) —rPr -fpWr- P ones 9 


(Name)_ 


item(s) listed below were: 
JS^ Received From 
Q Returned To 

□ Released To 

□ Seized 


(Street AddressL^^, I ~ r K1 ^ - JtlQ 0 

( Cit y)--- Lpx /£-^c g/sh 


03 r> 










FD-941 (2-26-01) 




which I own, possess, 


and located at 


control, and/or have access to, for any evidence of a crime or other violation of the law. The required passwords, logins, 


and/or specific directions for computer entry are as follows:_ 

I have been advised of my right to refuse to consent to this search, and I give permission for this search, freely 
and voluntarily, and not as the result of threats or promises of any kind. 


I authorize those Agents to take any evidence discovered during this search, together wit h the medium in/on which 
it is stored, and any associated data, hardware, software and compute r peripheral/ " 1 





Printed Full Name of Witness 


Location 








July 10 th Hack 


On July 10th, at approximately 7 pm PST, ImageShack’s services were compromised by a hacking 
group named anti-sec. 

The first user complaint came in at 6:59pm pst. 

Anti-sec gained access to one of our database servers. 


Server named: 



They posted this message after the attach on multiple security threads: 


This message linked back to the antisec's website: 


On Thu, 23 Jul 2009 we received an email from|_ 

provided some information on his site which was also hacked by the same group. 


which he 


b6 

b7C 

b7E 


email_ffom 

email_from 

attachment: 


Anti-Sec info 

The group we believe has at least two members 


some website registered under 






August 2 Hack 


On August 2 early in the morning about 12:50am pst we were compromised again. They were unable to 
effect users as we stop them in time. We have chat logs of our employee included. 


Chat logs: 


b6 
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Estimated company loses 







_ _/ l_l__l _ _ 

\__ \ / \ __\ I _ / _// __ \_/_\ 

/_\l I \ I I I /_/ \_\\ _A \_ 

c_ /_i /__l l__l /_ >\_ >\_ 
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Proudly presents... 
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1/ / 

1 1 '_ ' _ \ / 1/ 

1/ 

_ V 

/ __l 

1 \ 

1/ __l 


1 1 1 II 1 1 (.1 1 (_l 
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__/ 
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C-l < 

\_\ 

IJJ U !_l\_,_I\_, 

IV 

_1 

1_/ 

LI 1 _ I \_, 

_l\._LI 


__/ I 
I_/ 


Anti-sec. We're a movement dedicated to the eradication of 
full-disclosure. We wanted to give everyone an image of what we're 
all 

about. 

Full-disclosure is the disclosure of exploits publicly - anywhere. 
The 

security industry uses full-disclosure to profit and develop 
scare-tactics to convince people into buying their firewalls, 
anti-virus software, and auditing services. 

Meanwhile, script kiddies copy and paste these exploits and compile 
them, ready to strike any and all vulnerable servers they can get a 

hold 

of. If whitehats were truly about security this stuff would not be 
published, not even exploits with silly edits to make them slightly 
unusable. 

As an added bonus, if publication wasn't enough, these exploits are 
mirrored and distributed widely across the Internet with a nice 

little 

advertisement embedded in them for the crew or website which first 








exposed the vulnerability to the public. 

It's about money. While the world is difficult to change, and money 

will 

certainly continue to be a very important in the eyes of many, our 
battle is that of the removal of full-disclosure for the purpose of 
making it harder for the security industry to exploit its 
consequences. 

It is our goal that, through mayhem and the destruction of all 
exploitive and detrimental communities, companies, and individuals, 
full-disclosure will be abandoned and the security industry will be 
forced to reform. 

How do we plan to achieve this? Through the full and unrelenting, 
unmerciful elimination of all supporters of full-disclosure 
and the security industry in its present form. If you own a 

security 

blog, an exploit publication website or you distribute any 
exploits... 

"you are a target and you will be rm'd. Only a matter of time." 

This isn't like before. This time everyone and everything is 

getting 

owned. 


Signed: The Anti-sec Movement 

"No images were harmed in the making of this... image. 


b7E 







Replacing images... 


b7E 


If you think that we oppose your website, our advise is to pack it up and 
shut it down, because we're coming for you. 


- anti-sec. 
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Silicon Valley Regional 
Computer Forensic Laboratory 


4600 Bohannon Drive 
Suite 200 
Menlo Park, CA 94025 



REPORT OF EXAMINATION 


To: San Francisco 

San Jose RA 

saT~ 


Date: August 9, 2010 

Case ID No.: 288A-SF-145486 

Lab No.: SV-09-0162 


Reference: Communication (Request for Service) dated October 20,2009 
Imaging Report dated November 17,2009 

Ref. No.: N/A 

Title: ANTISEC UNSUBS; (V) IMAGESHACK 


b6 

b7C 


Date specimen received: October 21, 2009 


Specimens: 


b6 

hlC 

b7E 


Request: 


On October 20, 2009, Special Agent 


Federal Bureau of 


Investigation, requested that the above noted specimens, property of ImageShack, be 
examined pursuant to a signed consent form. She requested that the following items 
be searched for, identified (if present), documented, and reported on by the SVRCFL: 


1) Hacking rootkits and logs 

Summary of Examination: 

Attached and made part of this report is Imaging Report dated November 17,2009. 
While this report addresses the examination processes, the attached Imaging Report 
addresses the imaging of the submitted evidence. 


Enclosures: 0 
Page 1 of 3 


For Official Use Only 





/ 


r 


2: 

3 ^ 


These files were exported to a digital report. The other hard drives provided did 
not contain anything that appeared to be relevant. 


Details of Examination: 


SA | 1 provided thq 


Legal authority 

for the examination was provided as a signed consent form that was reviewed by the 
examiner prior to starting the examination. 


FH 


performed: 


used the examination image for review. The following processes 


were 


i; 

2: 


b6 
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Derivative Evidence: 


Disposition of Evidence: 


1) 

2 ) 


All original items. 


lo be returned to submitting agency. 


288A-SF-145486 
SV-09-0162 
Page 2 of 3 


For Official Use Only 






b7E 


y;' 

ji 


3) 1_I 

until its released to the investigator with this report. 

4) Special handling instructions include: 

a. All files contained on this DVD have the potential to contain viruses and other 
malicious code exported from the examined computer media. Therefore, this 
DVD should not be viewed on any networked computer OR any computer 
connected to the Internet. It is recommended this DVD only be viewed on a 
standalone workstation designed for the purpose of evidence review. Please 
consult your systems administrator for assistance and guidance. 

b. In certain investigations, files and information containing contraband such as 
pornographic images and trade secrets may have been discovered and copied onto 
this DVD. This can also include pornographic and obscene images of children. 
Extraordinary care must be taken to safeguard this material and properly secure it 
when not being used for investigative or legal purposes. The SVRCFL 
recommends this DVD be secured in appropriate storage, such as an evidence 
facility, when not being reviewed by the investigator. 

c. File attributes such as time/date stamps are dependent on several factors such as 
computer date/time settings and time zones. Where possible and feasible, 
date/time attributes have been preserved and details can be found in the electronic 
report contained herein. 

d. THIS DVD SHOULD NOT BE DUPLICATED or DISSEMINATED to parties 
outside of the requesting law enforcement agency or prosecutor's office without 
first consulting with Silicon Valley RCFL. 

e. This DVD is intended primarily for law enforcement and prosecution use. It is not 
recommended that this DVD work product be used for evidentiary hearings, trials, 
or other official proceedings. If any contents of this DVD are needed for a legal 
proceeding, the Silicon Valley RCFL should be contacted so that die relevant 
items can be provided in a form suitable for these purposes. 


Examiner: 


Silicon Valley Regional Computer Forensic Lab 
Computer Analysis Response Team 


b6 
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288A-SF-145486 
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Silicon Valley Regional 
Computer Forensic Laboratory 


4600 Bohannon Drive 
Suite 200 
Menlo Park, CA 94025 



REPORT OF EXAMINATION 


To: 


San Francisco 
San Jose RA 

s.aJ 


Date: November 17,2009 

b6 

Case ID No.: 288A-SF-145486 b 7< 

Lab No.: SV-09-0162 


Reference: Communication (Request for Service) dated October 20,2009 
Ref. No.: N/A 


Title: Image Shack 


Date specimens received: October 21, 2009 


Specimens: 


Request: 


b6 

b7C 

b7E 


Refer to the final Report of Examination for information on services requested. This 
report relates to the imaging processes only. 

Summary of Examination: 

Digital evidence media items were imaged to media to be retained as archives, and to 
staging media for future forensic examination by an assigned forensic examiner. 


Enclosures: 0 
Page 1 of3 


For Official Use Only 









Details of Examination: 




Prior to conducting any forensic process, I reviewed the legal authority, presented as 
a "Consent to Search" form. 

Upon submission to the SVRCL, each submitted item was inventoried. As part of the 
inventory process, each item was assigned a unique SVRCFL bar code, and was 
entered into the SVRCFL evidence system. Where appropriate, make, model, and 
serial number for each imaged item was recorded, and each item was digitally 
photographed. 

To preserve the original evidence and minimize any risk of damage to the original, an 
exact copy of the user-accessible data located on the evidentiary items was created 
onto staging media. (The exact copy will hereafter be referred to as an image.) The 
images were created using approved and appropriate forensic imaging software to 
write to forensically clean staging media prepared for use in an examination. Unless 
otherwise noted, the original evidence was write-protected using a hardware-write 
protection device to prevent any unintentional or accidental destruction or 
modification of the original evidence. An archive copy was also made using 
approved and appropriate software. 

The staging media will be used in the examination phase to further satisfy the request, 
while the archive copy will be retained in the SVRCFL evidence control room in 
order to preserve the evidence should it be required in the future for authentication or 
court processes. 


b7E 


_| All the original evidence was returned to the SVRCFL evidence control 

room. 

The following processes were performed during imaging of the original evidence: 

Physical Examination of Evidentiary items 
Write Protect Media 

Hardware Geometry and System Information 
Create Image 


b7E 


TUK - 

SV-09-0162 
Page 2 of 3 


For Official Use Only 




Verification 


* 


Items imaged: 
1.1 
2 . 

3. 

4. 

5. 

6 . 


Derivative Evidence (DE) generated during the course of this examination includes 
the fol lowing: 



b7E 


Stagi ng media used during the course of this examination includes the following: 

if 


Disposition of Evidence: 


All original evidence items returned to the SVRCFL evidence control room. All DE 
items will be retained in the SVRCFL evidence control room for a period of five 
years in order to preserve the evidence in the event additional forensic processes or 
legal proceedings require its use. After this time, the DE will be returned to the 
requestor’s agency for disposition. 


This imaging of this case is complete. The staging media will be given to an 
examiner for additional forensic processing. 


Examiner: 


Silicon Valley Regional Compter Forensics Lab 
Computer Analysis Response Team 


b6 
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N/A 

SV-09-0162 
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Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX: 650-289-3050 



SV-09-0162 


Evidence Details 

Total number of evidence items processed on this receipt: 9 


Description: 

Media Container: Accordion Folder 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial Number: 

Case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-145486 

Lab Designation / Designation Expl.: 

Not Examined (NE), [No designation 
explanation] 

Intake Container / Seal: 

None / None 

ECF Container / Seal: 

Plastic Bag / Heat Seal 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

, lYlaKs;_. 

Model: 

r i 

1-1 


Case ID / Lab number: 

i i 

SV-09-0162 

Agency Case Number: 

Lab Designation / Designation Expl.: 

288A-SF-145486 

Questioned (Q), [No designation explanation] 

Intake Packaging: 

ECF Container / Seal / Packaging: 

[Not recorded] 

[Not recorded] 

Intake Damage: 


[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

1 Make: 




r“"i 

Case lb i Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-145486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 


-bate/Time- 

Released By 

Received By 

Date/Time 
06/19/2010 

12:30 PM 

| fSVRCFL (Phone: 000-000-0000) * 




‘Indicates the Witness acl 


3 

10 

































































Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX: 650-289-3050 


Evidence Details 

Total number of evidence items processed on this receipt: 9 


SV-09-0162 


Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 


Model: 

ii 

1 

Serial Number: 

Case Id 1 Lab number: 

SV-09-0162 

Agency case Number: 

288A-SF-145486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 


Model: 




case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-145486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

Make* 


r* | 

1 

Serja l Number: 

Case ID / Lab number: 

1 - 1 

SV-09-0162 

Agency Case Number: 

Lab Designation / Designation Expl.: 

288A-SF-145486 

Questioned (Q), [No designation explanation] 

Intake Packaging: 

ECF Container / Seal / Packaging: 

[Not recorded] 

[Not recorded] 

Intake Damage: 


[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 



'Indicates the Witness acted as 


- page 2 o f 3 

Document Generation Date: 08/19/2010 

























































* Silicon Valley RCFL Return to Agency Evidence Receipt 


Regional Computer Forensics Laboratory 

4600 Bohannon Drive Suite 200, Menlo Park CA 94025 
650-289-3000 FAX: 650-289-3050 


Evidence Details 

Total number of evidence items processed on this receipt: 9 




Description: 

Hard Drive: HDD 

Storage Location: [Undetermined] 

Bflakai_ 







Case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

288A-SF-145486 

Lab Designation / Designation Expl.: 
Questioned (Q), [No designation explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 


Description: 

Media Container: plastic bag 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial dumber: 

Case ID / Lab number: 

SV-09-0162 

Agency Case Number: 

[No Agency Case Number] 

Lab Designation / Designation Expl.: 

Not Examined (NE), [No designation 
explanation] 

Intake Container / Seal: 

None / None 

ECF Container / Seal: 

Paper Bag / Heat Seal 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Description: 

DVD: digital report 

Storage Location: [Undetermined] 

Make: 

Model: 

Serial Number: 

Case Id / Lab number: 

SV-09-0162 

Agency Case Number: 

[No Agency Case Number] 

Lab Designation i Designation Expl.: 

Derivative Evidence (DE), [No designation 
explanation] 

Intake Packaging: 

[Not recorded] 

ECF Container / Seal / Packaging: 

[Not recorded] 

Intake Damage: 

[No damage recorded] 

Tracking Number: 



Property / Evidence Receipt 


Date/Time 

Released By 

Received fey 

Date /Time 

0 S/19/2010 

1230 PM 

Name/Agcncy 

Jann Hayes, SVRCFL (Phone: 000-000-0000) * 

Name/Agency 

Melanie Adams, FBI (Phone: 

408-998-5633) 
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‘Indicates the Witness acteJ 


bio 





























































08/19/10 

19:29:55 


FD-192 


ICMIPR01 
Page 1 


Title and Character of Case 


ANTI SEC 


Date Property Acquired: Source from which Property Acquired: 

SV-RCFL 

08/19/2010 


Anticipated Disposition: Acquired 


Case Agent 


Description of Property: 

IB 2 

ONE(1) CD LABELED SV-09-0162 (DERIVATIVE EVIDENCE OF 1B1) 


Date Entered 


Barcode: E4189947 


Location: SJECR 


PRESS3 


08/19/2010 


Case Number: 288A-SF-145486 
Owning Office: SAN FRANCISCO 


- Sf- I454&- (£>- Z 






Jit' 1 


V 


FD-1004 

Revised 

9-16-2009 


FEDERAL BUREAU OF INVESTIGATION 

EVIDENCE CHAIN-OF-CUSTODY 


Evidence Type: □ General □ Drug □ Firearm/Weapon 

& CART □ Valuable □ Firearm/Other 

Special Handling Instructions 


Initial Receipt 


Date and 
Time 

□ Batteries □ Biohazard □ FGJ 

□ HAZMAT □ Latents □ Refrigerate 

□ Req. Charging □ None 

□ Other 

Signa^ 







Relinquished Custody 

Date and 
Time 

Accepted Custody 

_1_ 

Date and 
Time 




320^ _ 

Signature: 



■ 


Printed Nam 


Reason:''/^ t*Pr /'d 

Reason: 

• Relinquished Custody 

Date and 
Time 


-g- 

Accepted Custody 

-1 

Date and 
Time 

Signature: 



■^9 



■mmmmmmmx 

Jn J i ^ 

Printed Nam 




/ r\ / 





Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 

Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 

Printed Name: 

Reason: 

Reason: 


Firearms Certification: 

Printed Name:_Signature: 


Case ID: __ - Sf-I454!? 4B: 




Date: 


Barcode: 
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* 1 0/21/09 
12:08:07 


FD-192 


ICMIPR01 
Page 1 


Title and Character of Case: 


ANTI SEC 


Date Property Acquired: Source from whi ch Property Acqui red: 

IMAGESHACK, C/0 1 I 263 N. SANTA CRUZ 

10/08/2009 263 N SANTA CRUZ AVE #100 

LOS GATOS CA 95030 



Case Number: 288A-SF-145486 
Owning Office: SAN FRANCISCO 




2m-SF'WS#&t> 






Firearms Certification: 

Printed Name:_Signature:_ Date:_ 

Case ID: Sp - [A IB:_ ^ _ _ Barcode: t~S ^ 






EVIDENCE CHAIN-OF-CUSTODY 



Relinquished Custody 


Relinquished Custody 


Signature: 


Printed Name: 


! Relinquished Custody 


Signature: 


Printed Name: 


Relinquished Custody 


Signature: 


Printed Name: 


Reason: 


Relinquished Custody 


Signature: 


Printed Name: 


Relinquished Custody 


Signature: 


Printed Name: 


Date and 
Time 


Date and 
Time 


Date and 
Time 


Date and 
Time 


Date and 
Time 


Accepted Custody 



Signature: 


Printed Name: 


Date and 
Time 


Accepted Custody 




Signature: 


Printed Name: 


Accepted Custody 


Signature: 


Printed Name: 


Accepted Custody 



Signature: 


Printed Name: 


Accepted Custody 



Signature: 


Printed Name: 


Accepted Custody 



Signature: 


Printed Name: 


Date and 
Time 



Date and 
Time 



Date and 
Time 



Date and 
Time 



Date and 
Time 



Date and 
Time 


















































EVIDENCE CHAIN-OF-CUSTODY 


Continuation Page 


Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 


Printed Name: 


Reason: 


Reason: 


Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 


Printed Name: 


Reason: 


Reason: 


' Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 


Printed Name: 


Reason:; 


Reason: 


Relinquished Custody 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 


Printed Name: 


Printed Name: 


Reason : 1 


Reason: 






RelinquisRed Custody " 

~ Dateand~ 
Time 

Accepted Custody 

— Date“and — 
Time 

Signature: 


Signature: 


Printed Name: 


Printed Name: 


Reason: ■ 


Reason: 


Relinquished Custody 

X*' w 

i 

Date and 
Time 

Accepted Custody 

Date and 
Time 

Signature: 


Signature: 

j 

Printed Name: 

- 

Printed Name: 


Reason: 

i 

Reason: 



Case ID: »••...._ IB:_,_Barcode: 
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UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 

Receipt for Property Received/Returned/Released/Seized 


File # 


On (date) 



(Street Address) 


MM&X 


Description of Item(s): 


item(s) listed below were: 
|—| Received From 
Returned To 
[~pReleased To 


Received By: 


Received Fr 


















o 






ir *SaL 
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FD-340 (Rev. 4-11-03) 


File Number 




Field Office Acquiring Evidence 


Serial # of Originating Document 
Date Received _ 


Document_ 

4 )>7 Ixoo- 


3 


From 


Federal Bureau of Investigation 
1919 S. Bascom Avenue 
Suite # 400 
Campbell, CA 95008 


(City and State) 


By 




J3rito 

-EHSio 


To Be Returned □ Ves 

Receipt Given D Yes 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 

□ Yes -EHfo 

Federal Taxpayer Information (FTI) 

Q Ye s JH-No 

Tide: 
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Reference: 


(Communication Enclosing Material) 


Description: □ Original notes re interview of / 

a£mj - 

'Tb 




^ 102 >» JUU^L. 


t P 60 








